The Fuelthemes Werkstatt WordPress theme up to version 4.8.3 contains a PHP Object Injection flaw (CWE‑502). The theme processes user‑supplied serialized data and passes it to PHP's unserialize() function. An attacker who can inject serialized objects through contributor or other input fields can trigger the unserialize operation to run arbitrary PHP code. This vulnerability allows the attacker to compromise confidentiality, integrity, and availability of the affected WordPress site, potentially giving full control over the system. Based on the description, it is inferred that the attacker can trigger the vulnerability by sending crafted HTTP requests containing malicious serialized payloads to the theme via contributor or custom fields.

All WordPress installations that include the Fuelthemes Werkstatt theme version 4.8.3 or any earlier release are affected. If the theme is still present on a live site, the vulnerability remains exploitable until the theme is removed or upgraded.

The CVSS score of 8.8 classifies this defect as high severity. The EPSS score of <1% indicates a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can trigger the vulnerability by sending crafted HTTP requests containing malicious serialized payloads to the theme via contributor or custom fields that the theme deserializes. The likely vector is remote.